/security--auth-review

Scans your code, config files and recent git history for API keys, tokens, passwords and private keys, and explains how to remediate each.

Runs your package manager's audit and lists each vulnerable dependency with its CVE, severity, fixed version and a remediation plan.

Audits your codebase against the OWASP Top 10 and returns each finding with severity, file and line, a description and a fix.

Traces where user input enters your code and where it ends up, flags SQL injection, XSS and similar flaws, and proposes the fix.

Reviews .env files, server settings and HTTP security headers, then generates a hardened configuration with a before and after comparison.

Reviews your CORS setup in Express, FastAPI, Django or Nginx, tightens overly permissive origins and headers, and verifies them with curl.

Analyzes the scripts, styles, images and connections your app uses and generates a Content Security Policy as a header and a meta tag.

Prepares you for a penetration test: sweeps for easy fixes, documents the scope and delivers a pentest-prep.md with a checklist and known risks.

Designs and adds rate limiting: picks an algorithm, sets per-route budgets, returns 429 with Retry-After and adds tests.

Analyzes your repo's architecture and writes threat-model.md with a data-flow diagram, rated STRIDE threats and a top-5 action list.

Sets up consumer-driven contract tests (Pact by default) so breakages between services are caught at build time without running both together.

Sets up load tests with k6, Locust or Artillery: realistic scenarios, pass/fail thresholds and a lightweight smoke gate in CI.